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Introduction 


U.S.  AIR  FORCE 


■  Purpose:  An  enterprise-wide  risk  assessment  framework  to  inform 
decisions  regarding  muitipie  sources  of  unavoidabie  risk 

■  Strategic  Goais:  Assess  current  miiitary  capabiiities  to  execute  current 
operationai  war  pians  and  support  appropriateiy  baiancing  Air  Force 
capabiiities  to  accompiish  future  defense  strategy 

■  We  need  a  structured  way  to  make  defensibie  decisions  regarding 
aiiocation  of  resources  for  both  current  and  future  budgets 

■  The  Air  Force  needs  to  express  risk  in  a  ianguage  that  both  DOD 
ieaders  and  Congress  understand 

■  Risk  Assessment  Framework  shouid  faciiitate  communication 

■  Heip  think  about  risk  and  buiid  assessments 

■  Assist  presenting  risk  to  decision  makers 

■  Guide  risk  discussions  within  and  across  disparate  functions  and 
scenarios 


Defendable  -  Measurable  -  Repeatable  -  Traceable  -  Linkable  -  Incorporates  Military  Judgment  -  Implementable  -  Scalable 
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Four  Parts  of  Risk  Assessment 

U.S.  AIR  FORCE  _ Framework 

■  Clarify  comprehensive  information  in  a  risk  assessment 

■  What  activity  or  collection  of  activities  are  being  assessed? 

■  What  are  the  content,  setting,  conditions,  and  assessment  ? 

■  What  is  the  assumed  risk  mitigation  actions? 

■  Standardize  presentation  of  individual  risk  assessments 

■  What  is  the  severity  and  its  likelihood  to  that  activity? 

■  What  metrics  underlie  that  assessment? 

■  Aggregate  individual  risks  to  assess  strategic  risk 

■  How  do  risk  for  various  activities  combine? 

■  How  does  this  combination  affect  risk  mitigation? 

■  Relate  types  of  risk  into  an  enterprise  risk  assessment 

■  How  does  force  management  risk  affect  operational  risk? 

■  What  is  driving  the  risk  and  where  should  resources  be  applied? 


U.S.  AIR  FORCE 


Four  Parts  of  Risk  Assessment 

Framework 


Clarify  comprehensive  information 


in  a  risk  assessment 


■  What  activity  or  collection  of  activities  are  being  assessed? 

■  What  are  the  content,  setting,  conditions,  and  assessment  ? 

■  What  is  the  assumed  risk  mitigation  actions? 


■  Standardize  presentation  of  individual  risk  assessments 

■  What  is  the  severity  and  its  likelihood  to  that  activity? 

■  What  metrics  underlie  that  assessment? 


■  Aggregate  individual  risks  to  assess  strategic  risk 

■  How  do  risk  for  various  activities  combine? 

■  How  does  this  combination  affect  risk  mitigation? 

■  Relate  types  of  risk  into  an  enterprise  risk  assessment 

■  How  does  force  management  risk  affect  operational  risk? 

■  What  is  driving  the  risk  and  where  should  resources  be  applied? 


U.S.  AIR  FORCE 


Information  in  Risk  Assessment 


■  When  someone  says  “this  is  high  risk”  what  information  is 
implicitly  communicated?  We  identify  11  aspects  in  4  groups: 

■  1)  The  activity  or  a  collection  of  activities  being  assessed 

■  2)  The  context  of  the  assessment 

■  Who  accomplished  or  approved  the  assessment 

■  When  they  completed  it 

■  The  type  of  risks  considered — specifies  the  assessment  scope 

■  The  analytic  rigor  of  their  assessment  process 

■  3)  Setting  of  the  assessment 

■  Scenario  and  timeframe 

■  Assumed  environmental  conditions  (economic,  political,  war,  ...) 

■  Assumed  major  choices  (acquisitions,  divestments,  policies,  ...) 

■  Mitigation  measures  taken  to  reduce  risk 

■  4)  Resulting  assessment  (metric  or  categorical  value) 


standardized  Risk  Statement 


w 

U.S.  AIR  FORCE 


For  (Activity),  (Organization)  on  (Date)  assesses  (Type  of  Risk)  with  (Anaiytic 
Rigor)  for  (Scenario)  assuming  (Conditions)  at  (Timeframe)  with  (Major  Choices), 

and  (Mitigation)  is  (Assessment). 

Activity 

Assessment  Context 

Assessment  Setting 

Assessment 

ACTIVITY 

ORG 

TYPE 

ANALYTIC 

SCENARIO 

CONDI- 

TIME- 

MAJOR 

MITIGATION 

ASSESS-MENT 

or 

and 

OF 

RIGOR 

TIONS 

FRAME 

CHOICES 

(Specified  or 

(metric  or 

OBJECTIVE 

DATE 

RISK 

AUTHORITY) 

categorical  value) 

Force 

Air 

Oper- 

SME  based 

Vignette  Y 

Near 

Programme 

Mitigating 

Low/  Green 

Generation 

Combat 

ational 

None 

d  Force 

weapon 

Cmnd 

Metrics/ 

Conflict  w/ 

Mid 

effectiveness 

Moderate/  Yellow 

Rapid  Global 

Force 

Mitigation 

Country  X 

War  in 

TOA  Force 

with  capacity 

Mobility 

Army 

Manag 

Scenario 

Far 

Significant/  Orange 

ement 

Metrics/ 

Operational 

A  has 

Budgeted 

Mitigating  force 

Homeland 

Joint 

Traceable 

Plan  XVI 

been 

FYDP 

Force 

structure 

High/  Red 

Defense 

Staff 

Etc... 

Metrics/ 

Scenario  Z 

initiated 

Etc... 

Etc... 

shortfall  with 
building 

Air 

Etc... 

Organi- 

A  nuclear 

partner 

Superiority 

zational 

Etc... 

weapon 

detonation 

capacity  effort 

Etc... 

Enterprise 

has 

occurred 

Etc... 

U.S.  AIR  FORCE 


Four  Parts  of  Risk  Assessment 

Framework 


■  Clarify  comprehensive  information  in  a  risk  assessment 


■  What  activity  or  collection  of  activities  are  being  assessed? 

■  What  are  the  content,  setting,  conditions,  and  assessment  ? 

■  What  is  the  assumed  risk  mitigation  actions? 


Standardize  presentation  of  individual  risk  assessments 


■  What  is  the  severity  and  its  likelihood  to  that  activity? 

■  What  metrics  underlie  that  assessment? 


■  Aggregate  individual  risks  to  assess  strategic  risk 

■  How  do  risk  for  various  activities  combine? 

■  How  does  this  combination  affect  risk  mitigation? 

■  Relate  types  of  risk  into  an  enterprise  risk  assessment 

■  How  does  force  management  risk  affect  operational  risk? 

■  What  is  driving  the  risk  and  where  should  resources  be  applied? 


U.S.  AIR  FORCE 


Metric  Based  Approach 

for  Performance,  Resource,  and  Schedule  Goals/Metrics 


OrgA  - 

^  Org  B  - 

Criteria  ^  " 

^  OrgC  ^  j 

Criteria  ^  * 

■  Metrics  based  assessment  measure  consequences  (or  at  least  planned  actions) 

■  Performance:  effectiveness,  mission  accomplishment,  deploy-to-dwell  ratios 

■  Resource/Cost:  capacity  or  quantities,  manpower,  dollars,  ... 

■  Schedule:  time  or  duration  until  mission  accomplishment,  days,  ... 

■  Simplicity:  presented  expected  metric  value,  rather  than  probability/severity  matrix 

■  Scalability:  defined  success  and  failure  points  appropriate  for  assessed  activity 

■  Consistency:  categorized  the  risk  assessment  according  to  severity  to  assessed  activity 


Success 

Sinqie  AF  Standard 

Fail 

0% 

■ 

20% 

50% 

80% 

100% 

Improved  risk  communication  and  understanding  throughout  the  Air  Force 
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Consistent  Criteria  Scaled  to 

Assessed  Activity 


W 

U.S.  AIR  FORCE 

Provides  a  structured  approach  where  performance,  resource,  and  schedule  metrics 
for  the  activities  underlie  the  risk  assessment 

■  Focused  on  information  leaders  need  (well  defined/defensible  assessment) 

■  Anchored  endpoints  (Success/Failure)  and  defined  thresholds  provide  concise, 
consistent  interpretation  of  results  (and  aligns  with  Joint  Staff  definitions) 

■  Defensibility  enhanced  by  metric  endpoints  and  assessments  developed  via 
modeling  &  simulation,  data  analysis,  wargaming,  exercises  and  SME  evaluations 


(Achieve  goal  or  activity) 


deteriorating  situation 


this  transition 


achieve  goal/activity 


Assessment  results  are  defined  by  these  levels  supported  by  analytics 
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U.S.  AIR  FORCE 


Scenario:  Next  Thursday  Bob  has 
a  0800  briefing  with  his  boss  at 
the  Pentagon.  Bob  must  drop  his 
daughter  off  at  daycare  not  earlier 
than  0630  in  Stafford. 


i 


Activity:  Opera 
car  Thurs  without 
mechanical  delay 

I 


Resource: 

Amount  of  gas 

in  fuel  tank 

4  gal 

2  gal 

1 


Resource: 
Amount  of  oil  in 
engine 


Assessed  at  2.1  gallons 
(High  Risk)  based  upon 
the  amount  of  money 
Bob’s  wife  has 
budgeted  for  gas,  the 
amount  currently  in  his 
tank  and  the  expected 
amount  of  gas  to  be 
used  prior  to  Thursday 


Assessed  at  4  quarts 
(Low  Risk)  based  upon 
the  amount  of  oil 
mount  currently  in  his 
tank  and  the  expected 
usage  prior  to 
Thursday 


A  Basic  Example 


Objective:  Arrive 
at  Pentagon  by 
0745 


Bob’s  briefing  is  at  High  Risk 
unless  he  can  mitigate  it  by 
convincing  his  wife  increase  his 
gas  budget  by  $4.  If  gas  is 
mitigated  then  it  would  be 
Moderate  Risk. 


Activity:  Deparf^--I^°  era  e^^^^ 
daycare  in  time  to 
arrive  at  Pentagon 


Schedule:  Transit 
time  from  Stafford  to 
Pentagon 


Performance:  Situational 
Awareness 


Able  to  identify  traffic  and  calculate/ 
display  an  optimal  diversion  route 
not  later  than  6  miles  prior  to 
encountering  any  backups 


Assessed  at  58  minutes 
(Moderate  Risk)  based 
upon  data  analysis 
showing  this  to  be  the 
median  transit  time 
from  Stafford  to  the 
pentagon  on  a 
Thursday 


Able  to  calculate  and  display 
optimal  diversion  routes  after 
encountering  backups 

Able  to  receive  some  warning  of 
potential  traffic  backups 


See  and  avoid  without  guidance 


Assessed  at  Low  Risk  because  Bob 
owns  a  GPS  with  traffic  alert 


Risk  Assessment 
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U.S.  AIR  FORCE 


Military  Activities 


Commander  Messaging 

Our  roles/objectives  are  ... 

With  given  resources/timeiine  our  risk  is 
We  may  mitigate  risk  by  ... 

To  reduce  risk  further  we  wouid  need _ 

(DOTMLPF)  changes  or  resources 


D 

E 

C 

I 

S 

I 

o 

N 

S 


Decision  Maker  Interpretation 
Defined  success/faiiure  points  make  sense 
If  the  risk  is  reaiized,  we  wiii  not  be  abie  to  ... 

Accepting  additionai  risk  wouid  free _ resources 

We  shouid  take  action  on  to  reduce  the  risk  of  . 
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U.S.  AIR  FORCE 


Evaluating  an  Assessment 

Questions  Senior  Leaders/Decision  Makers  Should  Ask! 


■  What  type  of  Risk  are  you  describing?  (Operational, 

Force  Management,  or  Institutional) 

■  What  metrics  form  the  basis  for  this  assessment? 

■  Are  these  consequences  or  performance  measures? 

■  Which  scenarios,  timeframes  and  force  structure  assumptions  did  you  use? 

■  What  defines  success  and  failure  for  the  assessed 
activity  in  the  scenario  and  timeframe? 

■  How  and  why  did  you  determine  those  success  and  failure  points? 

■  What  is  the  assessed  risk  with  mitigation  in  place? 

■  How  did  you  determine  the  values?  What  is  their  analytic  rigor? 

■  What  are  you  doing  today  or  recommend  for  the  future  to  mitigate  this  risk? 


Shifted  in  the  conversation  from  the  assessor’s  quaiifications  to 
the  expected  outcomes  of  the  activity  in  the  assessed  scenario! 
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U.S.  AIR  FORCE 


Four  Parts  of  Risk  Assessment 

5.  AIR  FORCE  Framework 


■  Clarify  comprehensive  information  in  a  risk  assessment 

■  What  activity  or  collection  of  activities  are  being  assessed? 

■  What  are  the  content,  setting,  conditions,  and  assessment  ? 

■  What  is  the  assumed  risk  mitigation  actions? 

■  Standardize  presentation  of  individual  risk  assessments 

■  What  is  the  severity  and  its  likelihood  to  that  activity? 

■  What  metrics  underlie  that  assessment? 


individual  risks  to  assess  strategic  risk 


■  How  do  risk  for  various  activities  combine? 

■  How  does  this  combination  affect  risk  mitigation? 

■  Relate  types  of  risk  into  an  enterprise  risk  assessment 

■  How  does  force  management  risk  affect  operational  risk? 

■  What  is  driving  the  risk  and  where  should  resources  be  applied? 


13 


U.S.  AIR  FORCE 


The  Baseline  Framework 

(Objectives,  Activities,  &  Goals) 


Context  or  Scenario  /  Timeframe 


-  Bounds  Threat/Force  Structure  Options 

-  Drives  Pianning 


Objectives  -  The 
desired  end  states 
of  the  planning 
construct  under 
assessment 


Activities  -  Those  actions 
that  support  the  planning 
construct  which  are  vital  to 
achieving  one  or  more 
objective 


Goals/Metrics  -  Independent 
effects-based  performance, 
resource,  or  schedule  metric 
indictors  of  the  potential  success 
or  failure  of  an  activity 


■  Framework  uses  a  strategy-to-task  approach  where  goals  support  activities  and  objectives 

■  Goals  are  assessed  based  on  performance,  resource,  and  schedule  metrics 

■  Roll-up  to  higher  levels  may  change  the  assessment  level 

■  Potential  reduced  if  multiple  activities  rely  on  common  goals/metrics 

■  Potential  improvement  if  additional  mitigation  means  are  available 

■  Approach  may  be  applied  at  various  levels  of  assessment  (tactical,  operational,  strategic) 


The  Objective/Activity/Goal  linkages  relate  the  risk  for  assessments 


Combining  Risk  Assessments 

LS.  AIR  FORCE  _ (Same  Activity) 

■  Different  aspects  of  the  same  activity 

■  The  combined  consequences  form  each  aspect  may  be 
deemed  sufficient  to  justify  a  worse  risk  assessment  than  any 
of  the  individual  assessments 

■  Related,  positive  correlation  (which  may  be  likely)  increases 
the  probability  of  a  combination  of  worse  consequences 

■  Hence,  the  combined  risk  assessment  may  be  worse  than  the 
individual  risk  assessments 

■  Example:  program  cost  and  schedule  are  positively  correlated 

■  If  the  program  is  behind  schedule,  usually  the  program  will 
also  be  over  cost 

■  Therefore,  combining  risks  assessments  for  cost  and 
schedule  should  indicated  increased  risk 
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Combining  Risk  Assessments 

U.S.  AIR  FORCE  _ (More  Aggregate  Activity) 

■  Combining  several  risk  assessments  to  a  more  aggregate  activity  risk 
assessment 

■  Does  the  scope  encompass  the  entire  aggregate  activity?  If  not 
collectively  exhaustive,  the  additional  scope  may  increase  risk 

■  If  not  mutually  exclusive  (individual  assessments  account  for  the 
same  consequences),  the  combined  risk  may  be  less 

■  Are  the  individual  activities’  outcomes  positively  correlated? 

■  If  so,  the  combined  consequences  or  increased  probability  may  make 
the  combined  risk  assessment  to  be  worse 

■  Do  the  underlying  activities  rely  on  common  mitigation 
resources? 

■  If  so,  then  the  combined  risk  assessment  should  be  worse  because 
the  probability  of  not  being  able  to  mitigate  more  than  one  bad 
outcome 

■  Does  the  aggregate  activity  have  alternative  approach  to  achieve 
the  objective? 

■  Alternative  mitigation  or  approach  would  reduce  the  risk  16 


CJCS  Integrated  Risk  Matrix 

The  Military  Risk  Application 

U.S.  AIR  FORCE 


RISK 

CRITERIA 

LOW 

MODERATE 

SIGNIFICANT 

Combatant 

Mission” 

Achieve  Objectives 
(Current  Ops) 

Very  Likely 
(ex:  80-100%) 

Likely 

(ex:50-807o) 

Questionable 
(ex:  20-50%) 

Unlikely 
(ex:  0-20%) 

Ivieve  Objectives 
Hontingencies) 

Very  Likely 
(ex:  Can  Win 
Decisive) 

Likely 

(ex:  Can  Swift  Defeat) 

Questionable 
(ex:  Must  Hold-Win) 

Unlikely 

(ex:  Cannot  Hold) 

assigned  missions 
at  acceptable 
human,  material, 
financial  and 
strategic  cost 

Authorities 

Full  Authority 
Provided  forall  OBJs 

Authority  Provided 
to  achieve mostOBJs 

Insufficient  Authority 
to  achieve  key  OBJs 

Lack  of  Authority 
jeopardizes  mission 

Pianning 

Level  III  or  IV  Plans 

Level  1  or  II  Plans 

CCDRCONOPs 
(Anticipated  Event) 

Initiate  Planning 
(ComplexCrisis) 

Resources  Meet 
Required  Timelines 

As  Planned 

Limited  Delays 
(Acceptable  Costs) 

Extended  Delays 
(Substantial  Costs) 

Extreme  Delays 
(Unacceptable  Costs) 

Service  / 
Joint  Force 

“Risk  to 
^^ForceJ^^ 

MeetCCDR  Req's 
(Current  Ops) 

Full  capacity  to 
source  all  req's 

World-Wide  solutions 
for  most  req's 

Shortfalls  in 
critical  requirements 

No  solutions  for 
critical  requirements 

MeetCCDR  Req's 
(Contingencies) 

Full  capacity  to 
source  all  req's 

Shortfalls  cause 
minor  plan  deviations 

Shortfalls  cause 
major  plan  deviations 

Shortfalls  make  plan 
execution  impossible 

DOTMLPF 
Capability 
^  vs.  Threat 

Dominance 

Superiority 

Parity 

Inferiority 

M  Readiness 

Strategic  Depth  for 
Full-Spectrum 
Missions 

Strategic  Depth  for 
Current  Operations 

Next-to-Deploy  Forces 
Ready  “Just  in  Hme” 

Deployed  Forces 

Not  Ready  for  Mission 

Ability  to  recruit, 
man,  train,  equip 
and  sustain  the 
forcetomeet 
strategic 
objectives 

Stress  on 
the  Force 

Limited  Stress 
(ex:  AC  DT>1:2) 

Increased  Stress 
(ex:1:2>DT>1:1.5) 

Prolonged  Stress 
(ex:1:1.5>DT>1:1) 

Extreme  Stress 
(ex:DT<1:1) 

Mobilization 

Presidential  Recall 
(ex:  RCDT>1:5) 

Limited  Partial  Mob 
(ex:1:5>DT>1:4) 

Partial  Mob 
(ex:1:4>DT>1:3) 

Full  Mobilization 
(ex:DT<1:3) 

Institutional 

Force  Development  & 
Industrial  Base  meet  all 
mission  requirements 

Force  Development  & 
Industrial  Base  meet 
priority  requirements 

Force  Development  & 
Industrial  Base  meet  some 
priority  requirem^s 

Force  Development& 
Industrial  Base  fail  to 
meet  essential  reqs. 

Risk  to  Mission  -  The  ability  of  the 
current  force  to  execute  strategy 
successfully  within  acceptable  human, 
materiel,  financial,  and  strategic  costs.* 
[AF  Extended  to  mid  and  far  term  for 
planning  assessments  to  cover  Future 
Challenges.]  * 

Risk  to  Force  -  The  ability  to  recruit,  train, 
educate,  equip,  and  retain  the  All- 
Volunteer  Force,  and  to  sustain  its 
readiness  and  morale.  This  includes 
Institutional  challenges  of  addressing 
management  and  business  practices  to 
plan  for,  enable,  and  support  the 
execution  of  DoD  missions  in  the  near, 
mid,  and  far  terms.  * 


Note;  *  The  definitions  for  how  risk  should  be  categorized  come  from  the  Risk  Assessment  Process  and  Methodology  for  the 
2014  Chairman’s  Risk  Assessment  (CRA)  -  4  June  2013. 


Air  Force  risk  assessments  aiign  with  this  Joint  Staff  matrix 
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U.S.  AIR  FORCE 


Identifying  Linkages 

For  Military  Risk  Applications 


Military  Risk 

CJCS  Matrix  Construct 


Risk  to  Mission 

-  Capability 

-  Capacity 

-  Future 
Challenges 


Objectives  -  The 
desired  end  states 
of  the  construct 
under  assessment 


Integrated  Security  Constructs  or 
CONPLAN/OPLAN  Scenarios 


^quirements  trace  top-down 


Vital/Key 

ACTIVITIES/TASKS 


Activity  1.1 


Activity  1 .2 


Activity  1 .3 


Activity  1 .4 


Vitai/Key 

PREDICTOR  METRiCS 


RSCE3=^^ 

Rsal=:^^' 

RSl)  J 


steady  State 


Activities  -  Those  actions 
performed  or  supported  by 
the  construct  which  are 
vital  to  achieving  one  or 
more  objective 


Assessments  trace  bottom-i 


Metrics  -  Independent 
measurable  effects-based 
resource,  schedule  or 
other/performance  (RSO) 
predictors  regarding  the 
success  or  failure  of  an  activity 


In  the  Military  Risk  Application  (Risk  to  Mission  and  Risk  to  Force),  Air  Force  elements  must  assess  their 
ability  to  meet  the  timelines  and  force  structure  requests  inherent  to  Combatant  Command  planning  or 
force  planning  constructs  for  the  future. 

Goals/Metrics  should  match  and  inform  at  the  level  of  assessment.  Strategic  level  assessment  should  be 
supported  by  strategic  level  metrics  (i.e.  million  ton  miles  per  day  is  informative  at  the  strategic  level  while 
the  readiness  level  of  an  individual  unit  is  not). 
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Four  Parts  of  Risk  Assessment 

U.S.  AIR  FORCE  _ Framework 

■  Clarify  comprehensive  information  in  a  risk  assessment 

■  What  activity  or  collection  of  activities  are  being  assessed? 

■  What  are  the  content,  setting,  conditions,  and  assessment  ? 

■  What  is  the  assumed  risk  mitigation  actions? 

■  Standardize  presentation  of  individual  risk  assessments 

■  What  is  the  severity  and  its  likelihood  to  that  activity? 

■  What  metrics  underlie  that  assessment? 


■  Aggregate  individual  risks  to  assess  strategic  risk 


■  How  do  risk  for  various  activities  combine? 

■  How  does  this  combination  affect  risk  mitigation? 


^Relate  types  of  risk 


into  an  enterprise  risk  assessment 


■  How  does  force  management  risk  affect  operational  risk? 

■  What  is  driving  the  risk  and  where  should  resources  be  applied? 
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Risk  Levels 


The  Relationship  Between  Military  Risk  Types 

Risk  to  Mission  and  Risk  to  Force  Exampie 


Unless  mitigated,  iowest  risk  assessment  drives  enterprise  risk  assessment 


Air  Force  Risk  Appiications 


U.S.  AIR  FORCE 

Core  Function  Support  Plan  Risk  Assessments 

■  Air  Force  Major  Commands  express  how  they  meet  Combatant 
Command  Requirements  in  2012  and  updated  in  2013  and  2014 

■  Laid  foundation  for  strategic  integration  of  long-term  priorities 

Strategic  Master  Plan  Capability  Gap  Assessment 

■  The  Air  Force  is  aggregating  the  core  function  support  plans  into  cor 
capability  risk  assessments  in  2014 

Air  Force  Requirements  Oversight  Council  (AFROC)  Application 

■  All  new  requirement  validations  require  two  assessments  of  with  and 
without  new  requirement 

■  Improving  link  between  requirement  risk  assessments  and  core  function 
risk  assessment 

Weapons  Systems  Sustainment  Application 

■  Best  application  to  date;  supports  informed  trades  decision  making 


Summary 


w 

U.S.  AIR  FORCE 

BENEFITS 

■  Compares  unlike  items  in  simple  and  flexible  framework 

■  Translates  presentation  of  existing  processes  rather  than  changing  them 

■  Allows  for  quantitative/objective  &  qualitative/subjective  data 

■  Facilitates  communication  and  discussion  to  senior  leaders 

■  Supports  assessments  at  multiple  organizational  levels 

■  Creates  basis  for  solid  analytic  support  to  decision  making 

■  Enables  aggregation  of  risk  assessments 

■  Provides: 

■  Common  taxonomy/definitions 

■  Scaled  risk  level  for  each  activity  based  on  success/failure 

■  Standardized  Format  Risk  Statements  (similar  and  complete  information) 

■  Aggregation  of  risk  metrics  to  the  enterprise  level 

■  Critical  information  to  senior  leaders  necessary  for  decision  making 


More  analytically  rigorous  support  for  defensible  decision  making 


Defendable  -  Measurable  -  Repeatable  -  Traceable  -  Linkable  -  Incorporates  Military  Judgment  -  Implementable  -  Scalable 
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